ignore istio init container while eBPF profiling about security-profiles-operator HOT 8 OPEN

I think we have what you need implemented in #833

Unfortunately docs are missing.

from security-profiles-operator.

I think we have what you need implemented in #833

Unfortunately docs are missing.

thanks @saschagrunert

Is that adding pod selector ?

This is how I have ProfileRecording with podSelector.

kind: ProfileRecording
metadata:
  name: app-recording
  namespace: app-dvlp-i2
spec:
  kind: SeccompProfile
  recorder: bpf
  podSelector:
    matchLabels:
      app: app1

from security-profiles-operator.

@sybadm no it's adding a containers field which references the name of the container to be recorded: cri-o/cri-o#7556

from security-profiles-operator.

Okay. SO I had look at the #833

Looks like it is implemented other way round to include the container name to record

kind: ProfileRecording
metadata:
  name: app-recording
  namespace: app-dvlp-i2
spec:
  kind: SeccompProfile
  recorder: bpf
  podSelector:
    matchLabels:
      app: app1
containers: ["nginx"]

What I was looking was ignore list than include list. Include list will need to be updated everytime when new containers are deployed and requires much maintenance

from security-profiles-operator.